二进制 2：ELF文件
1、本文命令引入
# 读取文件头部
readelf -h filename
# 查看文件信息
file filename
# 二进制查看文件
od -t x1 filename
2、定义来源
2.1 查找elf-header的定义
qemu/include/elf.h，32位与64位格式基本一致，本文以32位格式为主，定义如下
typedef struct elf32_hdr{
unsigned char e_ident[EI_NIDENT];
Elf32_Half e_type;
Elf32_Half e_machine;
Elf32_Word e_version;
Elf32_Addr e_entry; /* Entry point */
Elf32_Off e_phoff;
Elf32_Off e_shoff;
Elf32_Word e_flags;
Elf32_Half e_ehsize;
Elf32_Half e_phentsize;
Elf32_Half e_phnum;
Elf32_Half e_shentsize;
Elf32_Half e_shnum;
Elf32_Half e_shstrndx;
} Elf32_Ehdr;
2.2 e_ident内的定义
#define EI_MAG0 0 /* e_ident[] indexes */
#define EI_MAG1 1
#define EI_MAG2 2
#define EI_MAG3 3
#define EI_CLASS 4
#define EI_DATA 5
#define EI_VERSION 6
#define EI_OSABI 7
#define EI_PAD 8
3、查看一个文件
readelf -h arm-cortex-r52.elf
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x23000000
Start of program headers: 52 (bytes into file)
Start of section headers: 39476280 (bytes into file)
Flags: 0x5000400, Version5 EABI, hard-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 15
Size of section headers: 40 (bytes)
Number of section headers: 122
Section header string table index: 91
file arm-cortex-r52.elf
arm-cortex-r52.elf: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, with debug_info, not stripped
od -t x1 arm-cortex-r52.elf
0000000 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
0000020 02 00 2c 00 01 00 00 00 20 20 10 70 34 00 00 00
0000040 1c 1b 0e 00 00 00 10 00 34 00 20 00 0d 00 28 00
0000060 3a 00 37 00 01 00 00 00 00 02 00 00 00 00 00 50
0000100 00 00 00 50 00 00 00 00 80 44 00 00 06 00 00 00
4、位置介绍
header长度52byte，使用hexdump -n 52 xxx.elf
hexdump -n 52 erika3app.elf
0000000 457f 464c 0101 0001 0000 0000 0000 0000
0000010 0002 00f3 0001 0000 0000 2040 0034 0000
0000020 3d88 0013 0403 0000 0034 0020 000c 0028
0000030 0044 0042
0x0 :7f 45 4c 46 ELF识别字
0x13: Machine类型
0x18：ENTRY_ADDRESS 0x20400000
4.1 Machine类型介绍
X86_64 = 0x3e
X86_32 = 0x03
ARM = 0x28
MIPS = 0x08
POWERPC = 0x14
POWERPC64 = 0x15
SPARC = 0x02
SPARC64 = 0x2b
AARCH64 = 0xb7
RISCV = 0xf3
IA64 = 0x32
M68K = 0x04
5、其他架构
5.1 ELF（ARM-M）
readelf -h arm-cortex-m148.elf
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x501
Start of program headers: 52 (bytes into file)
Start of section headers: 342800 (bytes into file)
Flags: 0x5000400, Version5 EABI, hard-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 8
Size of section headers: 40 (bytes)
Number of section headers: 46
Section header string table index: 44
file arm-cortex-m148.elf
arm-cortex-m148.elf: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, with debug_info, not stripped
readelf -h arm-cortex-m32g.elf
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x34000401
Start of program headers: 52 (bytes into file)
Start of section headers: 2488544 (bytes into file)
Flags: 0x5000400, Version5 EABI, hard-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 11
Size of section headers: 40 (bytes)
Number of section headers: 61
Section header string table index: 59
arm-cortex-m32g.elf
arm-cortex-m32g.elf: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, with debug_info, not stripped
5.2 ELF（Tricore）
readelf -h tricore.elf
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Siemens Tricore
Version: 0x1
Entry point address: 0x70102020
Start of program headers: 52 (bytes into file)
Start of section headers: 924444 (bytes into file)
Flags: 0x100000
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 13
Size of section headers: 40 (bytes)
Number of section headers: 58
Section header string table index: 55
file tricore.elf
tricore.elf: ELF 32-bit LSB executable, Siemens Tricore Embedded Processor, version 1 (SYSV), statically linked, with debug_info, not stripped
5.3 ELF（PPC）
readelf -h ppc.elf
ELF Header:
Magic: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, big endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: PowerPC
Version: 0x1
Entry point address: 0xfc0000
Start of program headers: 52 (bytes into file)
Start of section headers: 598324 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 13
Size of section headers: 40 (bytes)
Number of section headers: 35
Section header string table index: 32
file ppc.elf
ppc.elf: ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, with debug_info, not stripped
5.3 ELF（Riscv）
readelf -h riscv.elf
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: RISC-V
Version: 0x1
Entry point address: 0x20400000
Start of program headers: 52 (bytes into file)
Start of section headers: 1260936 (bytes into file)
Flags: 0x403, RVC, single-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 12
Size of section headers: 40 (bytes)
Number of section headers: 68
Section header string table index: 66
投递快手等公司10个岗位